IsoApplet

If you have Yubikey, then this is fine https://xeiaso.net/blog/yubikey-ssh-key-storage. I have Google Titan NFC which is basically Feitian K9 NFC, so it doesn't support -O resident. Back in 2016 I was using https://github.com/philipWendland/IsoApplet which uses https://en.wikipedia.org/wiki/PKCS_11 standard, but modern way is much smoother as long as your OpenSSH server is up to date.

If you're interested in contactless cards with an option in the future to upgrade to something like Omni ring (https://store.nfcring.com/products/omni) or to use them with your phone, then do this: 1) Buy a contactless card reader from a good source e.g. https://www.javacardsdk.com/product/acr1252u or last two from this table https://webshop.d-logic.net/nfc-rfid-device-comparison, don't buy NFC ones, you need smartcard support specifically. Also steer clear of cheep ACR122U readers from ebay or ali, for some reason there are a lot of fakes https://www.acs.com.hk/en/press-release/2266/advanced-card-s... 2) Buy a few contactless javacards e.g. https://www.javacardsdk.com/product/j3h145/, don't buy EMV ones unless you're Europay, Mastercard or VISA. 3) Once you get them install opensc, pcsc-lite, ccid and get gp.jar from https://javacard.pro

BTW both PIV and GPG in Yubikeys are just applets and not particularly suited for SSH use either. Proper applet for it is this one https://github.com/philipWendland/IsoApplet, if you can install it of course. Some get confused or have bad associations when hearing the word 'applet', but that is what they are, as in 'Java applet'. This one is too https://developers.yubico.com/ykneo-oath/Releases/

Should've asked around, there were devices, standards and software for this kind of thing for a while e.g. https://github.com/philipWendland/IsoApplet

> The UX of this solution is poor Not surprising if you ask me, have you installed an applet for it? Do latest Yubikey even allow installing applets? Why are you using PIV for this? I was using https://github.com/philipWendland/IsoApplet with OpenSC and smartcards since 2016, no issues.

This is a crutch, backwards approach. Just use smart cards goddammit, that's what they were made for! https://github.com/philipWendland/IsoApplet/wiki

Go to Aliexpress or Ebay and search for JCOP. JCOP 3 should be contactless cards, JCOP 21 - not. Order whichever you want and then look for a card reader to match, keyword here is CCID. Some stuff you might see might be expensive, especially on Ebay, don't buy expensive stuff. Once you have them use these guides to install https://github.com/philipWendland/IsoApplet/wiki/Installatio... https://github.com/philipWendland/IsoApplet/wiki/Initializat...

You can buy a smartcard reader, some blank javacards and install this https://github.com/philipWendland/IsoApplet, seamless enough. I've been using it for about 3 years now I think. Other stuff you can do with smartcards https://github.com/EnigmaBridge/javacard-curated-list

Looks like you're using pkcs11 instead of inventing your own stuff, so kudos for that at least. But I wish people would be aware of smartcards more, they are all around us, but sort of invisible and unnoticed. 1. But cheap blank "Java" smartcards, more or less disposable 2. Install this applet on it https://github.com/philipWendland/IsoApplet 3. Works with OpenSC

I've used http://www.smartcardfocus.us/shop/ilp/se~any/so~5/p/index.sh... without any trouble - the Yubico GPG applet runs on them happily, and we're using https://github.com/philipWendland/IsoApplet for PKCS#11 based signing.

https://github.com/philipWendland/IsoApplet + some blank java cards + card reader. Something about Yubico rubs me the wrong way.

You mention that SmartCard-HSM/Nitrokey HSM are open source, which to me seems a bit disingenuous, since the most important part, the applet itself, is closed source AFAIK. You can't get the source that you can compile to a .cap file and upload it to your own blank java card. I'm using this instead https://github.com/philipWendland/IsoApplet

> The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4. YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions. If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead. A separate cardreader also means that you can use several smartcards for various things.

https://github.com/philipWendland/IsoApplet is a thing that you can load to your own blank Javacard. Come to think of it, you should be able to load ykneo-openpgp to your card also. https://developers.yubico.com/ykneo-openpgp/Releases/

People should use smartcards more. When stuff hits the fan you can just destroy it. https://github.com/philipWendland/IsoApplet